CVE-2022-4552

CVE-2022-4552 describes a Cross-Site Request Forgery (CSRF) vulnerability in the FL3R FeelBox WordPress plugin up to version 8.1. This flaw allows an attacker to trick a logged-in administrator into adding stored Cross-Site Scripting (XSS) payloads due to a lack of CSRF checks, sanitization, and escaping during settings updates. The vulnerability has a CVSS score of 6.1 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and potentially leading to low confidentiality and integrity impacts. The EPSS score is very low, suggesting a minimal likelihood of exploitation. There is no evidence of active exploitation, nor are there any public exploits available in Metasploit, Nuclei, or ExploitDB. The vulnerability has received no community discussion or media coverage, further indicating a low level of attention and perceived threat.